CVE-2025-43376: Apple Safari Information Disclosure Flaw

CVE-2025-43376 Overview

CVE-2025-43376 is an information disclosure vulnerability affecting multiple Apple products including Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. The vulnerability stems from a logic issue in the Private Relay feature's state management, which can allow remote attackers to view leaked DNS queries even when Private Relay is enabled.

Private Relay is a privacy feature designed to encrypt DNS traffic and hide users' IP addresses and browsing activity. This vulnerability undermines that protection by exposing DNS queries to potential network-level attackers, compromising user privacy expectations when using the feature.

Critical Impact

Remote attackers can intercept and view DNS queries from users who believe their browsing activity is protected by Private Relay, potentially exposing sensitive information about websites visited and online behavior.

Affected Products

• Apple Safari (versions prior to Safari 26)
• Apple iOS and iPadOS (versions prior to 18.7.7 and 26)
• Apple macOS Tahoe (versions prior to 26)
• Apple tvOS (versions prior to 26)
• Apple visionOS (versions prior to 26)
• Apple watchOS (versions prior to 26)

Discovery Timeline

• November 4, 2025 - CVE-2025-43376 published to NVD
• April 2, 2026 - Last updated in NVD database

Technical Details for CVE-2025-43376

Vulnerability Analysis

This vulnerability is classified as an information disclosure issue resulting from improper state management within Apple's Private Relay implementation. Private Relay is designed to route user traffic through two separate relays, preventing any single entity from seeing both the user's IP address and what sites they are accessing. The logic flaw in state management causes DNS queries to leak outside of the protected relay tunnel under certain conditions.

The vulnerability can be exploited remotely without requiring any privileges or user interaction. An attacker positioned on the network path between the victim and their destination could observe DNS queries that should have been encrypted and routed through the Private Relay infrastructure. This represents a significant privacy breach for users who rely on Private Relay to protect their browsing habits from network-level surveillance.

Root Cause

The root cause of CVE-2025-43376 is a logic error in the state management of the Private Relay feature. When transitioning between network states or under specific edge conditions, the system fails to properly enforce DNS query routing through the encrypted relay tunnel. This causes DNS resolution requests to be sent over the standard network path, bypassing the privacy protections that Private Relay is designed to provide.

Apple addressed this issue by implementing improved state management to ensure DNS queries are consistently routed through the Private Relay infrastructure regardless of network state transitions or edge conditions.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker does not need any special privileges or user interaction to exploit this flaw. The attack scenario involves:

1. A user with Private Relay enabled believes their DNS queries are encrypted and hidden from network observers
2. Due to the state management flaw, some DNS queries leak outside the relay tunnel
3. A remote attacker with network visibility (such as an ISP, compromised router, or man-in-the-middle position) can observe these leaked DNS queries
4. The attacker gains visibility into the user's browsing activity, including domains visited

The vulnerability allows high confidentiality impact as sensitive browsing information is exposed to unauthorized parties.

Detection Methods for CVE-2025-43376

Indicators of Compromise

• Unencrypted DNS queries originating from devices with Private Relay enabled
• DNS traffic routed through standard resolvers instead of Apple's relay infrastructure
• Network logs showing plaintext DNS requests from users who should have encrypted DNS via Private Relay

Detection Strategies

• Monitor network traffic for DNS queries from devices that have Private Relay configured and should be routing DNS through Apple's encrypted infrastructure
• Analyze firewall and proxy logs for DNS traffic patterns that indicate bypass of expected privacy relay routing
• Deploy endpoint detection to identify software versions vulnerable to CVE-2025-43376

Monitoring Recommendations

• Enable detailed logging on DNS servers to identify potential exposure from vulnerable Apple devices
• Configure network monitoring solutions to alert on unencrypted DNS traffic from expected Private Relay users
• Review endpoint inventory to identify devices running vulnerable versions of iOS, iPadOS, macOS, tvOS, visionOS, watchOS, or Safari

How to Mitigate CVE-2025-43376

Immediate Actions Required

• Update all Apple devices to the patched versions: Safari 26, iOS 18.7.7/26, iPadOS 18.7.7/26, macOS Tahoe 26, tvOS 26, visionOS 26, or watchOS 26
• Verify Private Relay is functioning correctly after updates by testing DNS query routing
• Consider using additional VPN services as a temporary supplementary privacy measure until devices are fully patched
• Review network logs to assess potential historical exposure from this vulnerability

Patch Information

Apple has released security updates that address this vulnerability through improved state management. The following versions contain the fix:

• Safari 26
• iOS 18.7.7 and iOS 26
• iPadOS 18.7.7 and iPadOS 26
• macOS Tahoe 26
• tvOS 26
• visionOS 26
• watchOS 26

For detailed patch information, refer to the Apple Security Advisory #125108, Apple Security Advisory #125113, Apple Security Advisory #125114, Apple Security Advisory #125115, and Apple Security Advisory #125116.

Workarounds

• Disable Private Relay temporarily if immediate patching is not possible, and use a trusted third-party VPN service for DNS privacy
• Configure devices to use encrypted DNS services (DNS-over-HTTPS or DNS-over-TLS) as an additional layer of protection
• Restrict network access for vulnerable devices to trusted networks only until patches can be applied
• Monitor for software updates through Apple's automatic update mechanism and apply them as soon as they become available